> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/wazuh/wazuh-dashboard-plugins/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Started with Wazuh Dashboard

> A comprehensive guide to help you get started with Wazuh Dashboard Plugins and navigate the user interface effectively

## Overview

Wazuh Dashboard provides a powerful web interface for security monitoring, threat detection, and compliance management. This guide will help you get started with the dashboard and understand its core features.

## What is Wazuh Dashboard?

Wazuh Dashboard is the visualization and management interface for the Wazuh security platform. It enables you to:

* Monitor security events in real-time
* Analyze threats and vulnerabilities
* Manage agents across your infrastructure
* Track compliance with regulatory standards
* Visualize security data through interactive dashboards

## First Steps

**1. Access the Dashboard**

Navigate to your Wazuh Dashboard URL (typically `https://your-server:443`) and log in with your credentials.

The default credentials are:

* **Username**: admin
* **Password**: admin (change this immediately after first login)

**2. Understand the Layout**

The dashboard interface consists of several key areas:

* **Top Navigation Bar**: Access to global search, time picker, and user settings
* **Left Sidebar**: Main navigation menu for modules and features
* **Main Content Area**: Displays dashboards, visualizations, and data tables
* **Agent Selector**: Quick access to switch between agents (when available)

**3. Configure Your First API Connection**

Before you can view data, ensure your Wazuh API is properly configured:

1. Go to **Server Management > API Configuration**
2. Click **Add new API**
3. Enter your API details:
   * Cluster/Manager name
   * URL (e.g., `https://your-wazuh-manager:55000`)
   * Port (default: 55000)
   * Username and password
4. Click **Save** to test the connection

**4. Verify Index Patterns**

Wazuh uses index patterns to access data:

* **wazuh-events-\***: Default index pattern for security events
* **wazuh-states-\***: Index patterns for agent state information

The dashboard automatically creates these patterns during initial setup.

## Navigating the Dashboard

### Main Menu Sections

The left sidebar organizes features into logical groups:

> **Server Management**
>
> Manage your Wazuh server infrastructure:
>
> * **Statistics**: View server performance metrics
> * **Cluster Management**: Monitor cluster nodes and status
> * **API Configuration**: Configure API connections
> * **Settings**: Server and agent configuration

> **Agent Management**
>
> Monitor and control deployed agents:
>
> * **Agents Overview**: View all registered agents
> * **Agent Summary**: Detailed information for individual agents
> * **Deploy New Agent**: Wizard for agent deployment
> * **Groups**: Organize agents into logical groups

> **Threat Detection**
>
> Security monitoring and analysis:
>
> * **Security Events**: Real-time security event stream
> * **Threat Hunting**: Advanced threat detection dashboards
> * **Malware Detection**: Monitor malware detection events
> * **MITRE ATT\&CK**: Map detections to MITRE framework

> **Compliance & Auditing**
>
> Regulatory compliance modules:
>
> * **PCI DSS**: Payment Card Industry compliance
> * **GDPR**: General Data Protection Regulation
> * **HIPAA**: Healthcare compliance monitoring
> * **NIST 800-53**: NIST framework compliance
> * **TSC**: Trust Services Criteria

> **IT Hygiene**
>
> System monitoring and vulnerability management:
>
> * **Vulnerability Detection**: Identify security vulnerabilities
> * **File Integrity Monitoring**: Track file changes
> * **Security Configuration Assessment**: SCA policy monitoring
> * **System Inventory**: Hardware and software inventory

> **Cloud Security**
>
> Cloud platform monitoring:
>
> * **Amazon Web Services**: AWS security monitoring
> * **Google Cloud**: GCP event analysis
> * **Azure**: Microsoft Azure monitoring
> * **Office 365**: Office 365 security events
> * **GitHub**: GitHub security monitoring
> * **Docker**: Container security monitoring

## Using the Time Picker

The time picker in the top navigation bar controls the time range for all data displays:

1. Click the **time selector** (shows current range, e.g., "Last 15 minutes")
2. Choose from quick ranges:
   * Last 15 minutes
   * Last 1 hour
   * Last 24 hours
   * Last 7 days
   * Last 30 days
3. Or set a **custom range** with specific start and end times
4. Enable **Auto-refresh** to update data automatically

> [!NOTE]
>
> The time picker affects all dashboards and visualizations. Always verify your time range when investigating specific events.

## Search and Filter

### Global Search Bar

Most views include a search bar powered by OpenSearch Query Language:

```
// Search for specific rule ID
rule.id:5503

// Search for events from a specific agent
agent.name:"web-server-01"

// Combine conditions
rule.level:>=10 AND rule.groups:"authentication_failed"

// Search within a field
data.srcip:192.168.1.*
```

### Applying Filters

**1. Click on a Value**

In any data table or visualization, click on a value to see filter options.

**2. Choose Filter Action**

* **Filter for value**: Show only records with this value
* **Filter out value**: Exclude records with this value
* **Exists**: Show records where this field exists

**3. Manage Active Filters**

Active filters appear below the search bar:

* Click the **X** to remove a filter
* Click the filter to edit or invert it
* Use **Disable** to temporarily deactivate without removing

## Working with Agents

### Agent Selector

Many modules include an agent selector that allows you to:

1. **View All Agents**: See aggregated data across your infrastructure
2. **Pin Specific Agent**: Focus on a single agent's data
3. **Switch Agents**: Quickly change between agents

### Agent Status Indicators

* **Active** (green): Agent is connected and reporting
* **Disconnected** (red): Agent is not communicating
* **Never Connected** (gray): Agent registered but never connected
* **Pending** (orange): Agent registration pending

## Customizing Your Experience

### Dashboard Preferences

Configure your dashboard experience:

1. Click your **username** in the top right
2. Select **Settings** or **Advanced Settings**
3. Adjust preferences:
   * Default time range
   * Refresh interval
   * Theme (light/dark)
   * Date format
   * Timezone

### Saved Searches and Filters

Save frequently used searches:

1. Configure your search and filters
2. Click **Save** in the search bar
3. Provide a descriptive name
4. Load saved searches from the dropdown menu

## Understanding Dashboards

### Dashboard Components

Each module provides pre-built dashboards with:

* **Visualizations**: Charts, graphs, and metrics
* **Data Tables**: Detailed event listings
* **Statistics Panels**: Key performance indicators
* **Heat Maps**: Geographic or temporal patterns

### Interacting with Visualizations

> **Click to Filter**
>
> Click on any visualization element to automatically filter the entire dashboard:
>
> * Click a bar in a bar chart
> * Select a pie slice
> * Click a point on a line graph

> **Hover for Details**
>
> Hover over visualization elements to see detailed tooltips with exact values and additional context.

> **Expand Visualizations**
>
> Click the **expand** icon to view a visualization in full-screen mode for detailed analysis.

> **Export Data**
>
> Use the **export** option to download visualization data in various formats (CSV, JSON).

## Health Check and Troubleshooting

Wazuh Dashboard includes a health check system that monitors:

* **API Connectivity**: Ensures server API is accessible
* **Index Patterns**: Verifies index patterns are configured
* **Sample Data**: Confirms data is flowing correctly
* **Notification Channels**: Checks alerting configuration

> [!WARNING]
>
> If you see health check warnings or errors:
>
> 1. Review the specific error message
> 2. Check API configuration in Server Management
> 3. Verify index patterns exist
> 4. Ensure agents are connected and reporting
> 5. Check server logs for detailed error information

## Quick Tips for New Users

> **Start with Overview**
>
> Begin your investigation in the **Overview** section of each module to understand overall security posture before diving into details.

> **Use Time Context**
>
> Always set an appropriate time range for your investigation. Recent incidents require narrow ranges; trend analysis needs wider ranges.

> **Pin Important Agents**
>
> Use the agent selector to pin critical servers or workstations for focused monitoring.

> **Bookmark Useful Views**
>
> Add frequently used dashboards to your browser bookmarks for quick access.

## Next Steps

Now that you understand the basics, explore these guides:

* [Threat Analysis](/guides/threat-analysis) - Learn threat detection workflows
* [Compliance Monitoring](/guides/compliance-monitoring) - Track regulatory compliance
* [Agent Deployment](/guides/agent-deployment) - Deploy and manage agents effectively

## Common Tasks Quick Reference

| Task | Navigation Path |
| - | - |
| View security events | Security Events > Dashboard |
| Check agent status | Agents > Overview |
| Deploy new agent | Agents > Deploy New Agent |
| Run threat hunt | Threat Hunting > Dashboard |
| Check vulnerabilities | Vulnerabilities > Dashboard |
| Review compliance | \[Module] > Compliance (e.g., PCI DSS) |
| Configure server | Server Management > Settings |
| Manage API | Server Management > API Configuration |

## Getting Help

If you need assistance:

* **Documentation**: [https://documentation.wazuh.com](https://documentation.wazuh.com)
* **Community Slack**: [Join Wazuh Slack](https://wazuh.com/community/join-us-on-slack/)
* **Forum**: [Google Groups Forum](https://groups.google.com/forum/#!forum/wazuh)
* **GitHub**: [Report Issues](https://github.com/wazuh/wazuh-dashboard-plugins)

> [!TIP]
>
> The Wazuh community is active and helpful. Don't hesitate to ask questions on Slack or the forum!


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.